Bump Woodpecker CI to v3.16.0

Move the Woodpecker helm chart from 3.6.3 (appVersion 3.14.1) to 3.6.5
(appVersion 3.16.0), upgrading server and agent together. Enable the new
agent flag that gates step-level serviceAccountName so existing pipelines
keep working.

- Bump helmChart version 3.6.3 -> 3.6.5 in the au-syd1 overlay (server +
  agent both render as v3.16.0 via the chart appVersion).
- Set WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP=true on
  the agent; 3.16.0 (GHSA-qf34-295c-26v8) gates step-level
  serviceAccountName behind this flag (default false), and the estate's
  pipelines set backend_options.kubernetes.serviceAccountName.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

apps/overlays/au-syd1/woodpecker/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 helmCharts:
   - name: woodpecker
     repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.6.3"
+    version: "3.6.5"
     releaseName: woodpecker
     namespace: woodpecker
     valuesFile: values.yaml

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -6,6 +6,11 @@ agent:
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
     WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
+    # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
+    # serviceAccountName is gated behind this agent flag (default false).
+    # The estate's pipelines set backend_options.kubernetes.serviceAccountName
+    # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
+    WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
     WOODPECKER_LOG_LEVEL: debug
   #extraSecretNamesForEnvFrom:
   #  - woodpecker-default-agent-secret